Security/Auth path · Step 1
Edit a fake Login API request, inspect realistic auth responses, then write what you would test and compare your answer with structured API QA checklist coverage.
/api/auth/loginInteractive sandbox
Edit the request body, choose auth conditions, send a simulated POST /api/auth/login request, and inspect the fake API response. No real data is sent.
1. EDIT REQUEST
/api/auth/loginTest case presets
Choose a case, inspect the fake response, then write what you would test.
2. INSPECT RESPONSE
3. WRITE TEST IDEAS
List contract checks, valid email/username login, missing fields, wrong password, unknown users, account states, MFA, token/session behavior, security, rate limiting, observability, and reliability.
Use Markdown lists to organize your test ideas.
Ready to evaluate: include happy path, negative cases, auth, data, errors, and observability.
4. COMPARE ANSWER
API reference
Use this reference while you experiment in the sandbox and write test ideas.
/api/auth/loginEmail/password or username/password if username login is supported
{
"email": "qa.user@example.com",
"password": "Password123!",
"rememberMe": false
}No bearer token required
200 OK
{
"accessToken": "eyJhbGciOi...",
"refreshToken": "rt_fake_refresh_token",
"tokenType": "Bearer",
"expiresIn": 900,
"user": {
"id": "usr_123",
"email": "qa.user@example.com",
"role": "user",
"status": "active"
}
}API interview guide
This scenario trains API test design for authentication endpoints where credential validation, account states, token creation, and safe error handling all matter.
How would you test a Login API that accepts email or username plus password and returns access and refresh tokens?